What Is EDR and MDR? Does Your SME Actually Need It?

Antivirus checks every file against a list of known bad ones — a security guard with a book of wanted photos. EDR (endpoint detection and response) is the security camera that watches behaviour instead: it doesn't need to recognise the burglar to notice someone carrying the safe out at 2am. MDR (managed detection and response) is that camera plus a 24/7 team who actually run over when it triggers. Published 2026 prices run roughly US$2–6 per device per month for antivirus, US$3–25 for EDR and US$10–60 for MDR — and for most Singapore SMEs past about 15 staff, EDR is now the baseline and MDR is the question. Here's how to answer it for your business.

Why the wanted-photos approach stopped being enough

Traditional antivirus works by recognition: here's a known virus, block it. It still catches plenty. But modern attacks don't arrive as a known file — a phished password gets used to log in like a normal employee, then legitimate tools already on the machine are used to move around and encrypt. Nothing on that path is on the wanted list. Recognition-based protection sees a staff member working late; behaviour-based protection sees an account that has never touched the finance share suddenly reading all of it at midnight.

The three layers, in shop terms

• Antivirus — the guard with the photo book. Cheap, necessary, limited to what it already knows. Roughly US$2–6 per device per month, and often bundled free.
• EDR — the security camera. Records what every device does, flags suspicious behaviour, can isolate a machine from the network with one click. The catch: a camera only helps if someone watches the footage and reacts — and a 3am alert in an SME with no IT team is a recording of the burglary, not a prevention of it. Roughly US$3–25 per device per month.
• MDR — the camera plus a guard who runs over. A provider's analysts watch the EDR alerts around the clock, throw out the false alarms, and contain real incidents — isolating the device, killing the process, waking you up only when it matters. Roughly US$10–60 per device per month depending on who runs it and what's included.

One pricing note worth knowing: Microsoft Defender for Business — a genuine EDR — is included in Microsoft 365 Business Premium, which many Singapore SMEs already pay for. If that's your licence, the EDR layer may be sitting unconfigured in a subscription you already own.

Does your SME actually need the upgrade?

Honest answer: it depends on what an incident would cost you, not on what a vendor says. Three questions settle it:

1. What's your downtime number? Run the five-minute napkin math. If a three-day ransomware outage costs you S$40,000+, MDR at a few hundred dollars a month is cheap insurance. If you're five people who can work off phones, EDR alone may be the right call.
2. Who watches the alerts at 3am? If the answer is "nobody", EDR without a service behind it is a camera nobody monitors. Either your IT provider includes monitoring in their managed service, or you need MDR. There's no third option that works.
3. Do clients or insurers ask? Cyber insurance questionnaires and vendor security assessments increasingly ask for EDR by name and for 24/7 response capability. If those forms are landing on your desk, the decision has been made for you.

Self-check: ask your IT provider two questions — "What's on our laptops: antivirus or EDR?" and "If it alerts on Sunday at 3am, what happens?" Vague answers to either are your answer.

What it looks like when it works

A typical good outcome: an employee's password is phished on a Friday night, the attacker logs in and starts exploring. The EDR flags a login followed by unusual file access; the MDR analyst sees it within minutes, isolates the laptop from the network, resets the account, and the business opens on Monday with an email about a password change — not with a ransom note. Same attack, same company, two very different Mondays. The whole value is the gap between the alert and the response.

Frequently asked questions

Is EDR the same as antivirus?

No. Antivirus recognises known bad files. EDR records and judges behaviour on the device and can respond — isolate, kill, roll back. Most modern EDR products include antivirus; the reverse isn't true.

Can we just buy EDR and skip MDR?

Yes, if someone competent watches it — your managed IT provider, typically. EDR with no one monitoring is the most common half-measure we see: the alert fired at 2am, nobody read it, and the forensics afterwards were excellent.

Does Cyber Essentials require EDR?

The Cyber Essentials mark requires anti-malware protection on devices under its Secure/Protect area; EDR satisfies it comfortably and is what assessors increasingly expect to see. It's also item 6 on our 15-point checklist.

Why do prices vary so much?

Because "MDR" covers everything from a vendor's automated response to a staffed 24/7 operations centre with named analysts. Ask what humans do, how fast, and whether they contain or just notify. It's also why security depth is one of the biggest levers in managed IT pricing.

Our approach

EDR with monitored response is part of our managed IT baseline — the camera and the guard, not just the camera. If you're not sure what's actually running on your laptops today, book a discovery call: we'll tell you what you have, what you already pay for and haven't switched on, and whether the upgrade is worth it for your downtime number.